Free Software Foundation President Richard Stallman today called Ubuntu Linux "spyware" because the operating system sends data to Ubuntu maker Canonical when a user searches the desktop.

But his complaint is already falling on deaf ears—Canonical said today that it plans to increase use of the feature Stallman objects to in order to deliver expanded Internet search results in the next version of Ubuntu.

In Ubuntu 12.10, searching the Dash (the hub for finding stuff in the Unity desktop interface) for files and applications returns not only results from a user's desktop but also Amazon shopping results, as we reported in September before the operating system's release. If a user buys something from Amazon as a result, money is sent to Canonical in the form of affiliate payments.

User complaints forced Canonical founder Mark Shuttleworth to defend the move on his blog, but the Amazon shopping results were implemented in Ubuntu 12.10 as scheduled. Stallman, the outspokenfigure who started the free software movement, published his own take on the matter today, and he was just as critical as you'd expect.

"Ubuntu, a widely used and influential GNU/Linux distribution, has installed surveillance code," Stallman wrote in a post titled "Ubuntu Spyware: What to Do?" "When the user searches her own local files for a string using the Ubuntu desktop, Ubuntu sends that string to one of Canonical's servers. … Ubuntu uses the information about searches to show the user ads to buy various things from Amazon. Amazon commits many wrongs (see http://stallman.org/amazon.html); by promoting Amazon, Canonical contributes to them. However, the ads are not the core of the problem. The main issue is the spying. Canonical says it does not tell Amazon who searched for what. However, it is just as bad for Canonical to collect your personal information as it would have been for Amazon to collect it."

Canonical does provide an easy way to switch the search results off, as this screenshot from the Ubuntu settings shows:

Ubuntu allows users to switch the surveillance off. Clearly Canonical thinks that many Ubuntu users will leave this setting in the default state (on). And many may do so, because it doesn't occur to them to try to do anything about it. Thus, the existence of that switch does not make the surveillance feature ok.

Even if it were disabled by default, the feature would still be dangerous: "opt in, once and for all" for a risky practice, where the risk varies depending on details, invites carelessness. To protect users' privacy, systems should make prudence easy: when a local search program has a network search feature, it should be up to the user to choose network search explicitly each time. This is easy: all it takes is to have separate buttons for network searches and local searches, as earlier versions of Ubuntu did. A network search feature should also inform the user clearly and concretely about who will get what personal information of hers, if and when she uses the feature.

Canonical doubles down

We asked Canonical for a response, and the company pointed us to a blog post that it published today. The post isn't a direct reply to Stallman—it talks about plans Canonical has to expand Internet search results in the Dash in Ubuntu 13.04, the next version of the OS.

This means that "a search for 'The Beatles' is likely to trigger the Music and Video scopes, showing results that will contain local and online sources—with the online sources querying your personal cloud as well as other free and commercial sources like YouTube, Last.fm, Amazon, etc.," Canonical's Cristian Parrino wrote. "To achieve this, the Dash will call a new smart scope service which will return ranked online search results, which the Dash will then balance against local results to return the most relevant information to the user."

The goal "is to provide Ubuntu users the fastest, slickest way to find things right from their home environment—independent of whether those 'things' are on your machine, available online, free, or commercial."

Canonical says it can do this in a way that doesn't violate user privacy. "The data we collect is not user-identifiable (we automatically anonymize user logs and that information is never available to the teams delivering services to end users), we make users aware of what data will be collected and which third party services will be queried through a notice right in the Dash, and we only collect data that allows us to deliver a great search experience to Ubuntu users," Parrino wrote. "We also recognize that there is always a minority of users who prefer complete data protection, often choosing to avoid services like Google, Facebook, or Twitter for those reasons—and for those users, we have made it dead easy to switch the online search tools off with a simple toggle in settings."

Canonical is clearly in need of more funding—that's why it's asking users to donate money toward Ubuntu development when they download the OS. Canonical surely knew it would draw criticism for including Amazon search results in regular desktop searches, but it must have decided that enough users would like the feature and that it would bring in enough money to make it worth the criticism.

Stallman was never going to be a fan of Ubuntu, as it includes some repositories of non-free software. But the Amazon search results make things worse, he wrote. "Any excuse Canonical offers is inadequate," he wrote. "Even if it used all the money it gets from Amazon to develop free software, that can hardly overcome what free software will lose if it ceases to offer an effective way to avoid abuse of the users."

Stallman concluded with a plea that people who recommend or redistribute free operating systems "remove Ubuntu from the distros you recommend or redistribute." Ubuntu is still the most popular Linux distribution. While we suspect most "regular" users of Ubuntu will be satisfied with the on/off toggle for the online search results, there may well be a significant number who flee for an alternative distribution.

Can we please stop reporting on everything that comes out of Stallman?

He did some very good work on the early days of the free software movement, but like James Watson and some of his more recent controversial statements, well, they really have nothing to do with his discovery of the shape of DNA.

""...is to provide Ubuntu users the fastest, slickest way to find things right from their home environment—independent of whether those 'things' are on your machine, available online, free, or commercial."

This is such BS. The goal of Canonical is to get affiliate payments, just as the article points out. They can masquerade it as a "search enhancement" all they want but it is what it is. As radical as Stallman can be, he has a point here. If I am searching for files on my hard drive, I want it to be just that. I don't want my search to turn into an ad or a way for Amazon to sell me something. Others may feel differently which brings the question, is it possible to turn this feature off?

As for privacy and the exchange of PII information with amazon, after hearing about what facebook is doing with the exchange and matching of "hashed" email addresses and other information with retailers in order to tailor advertisements and track user habits, I no longer believe any of these companies when they say they are not selling your information. They may not be exchanging your information in humanly readable form as originally provided but they sure are exchanging the 1s and 0s that make up who we are...

Say what you like about Stallman (and I've said much of it in the past), he remains a very valuable voice and a benchmark by which positions may be measured.

Canonical aims to get affiliate payments (as others have noted), but also aims to integrate "cloud" with "local", in a way privacy advocates like Stallman do not like. In a way, Stallman loves his walled garden, but that walled garden is his own computer, and he will construct gates in the wall at his leisure, not at Canonical's.

While we may not always agree with Stallman, if we deny his value then we're exposing none but our own ignorance.

Can we please stop reporting on everything that comes out of Stallman?

He did some very good work on the early days of the free software movement, but like James Watson and some of his more recent controversial statements, well, they really have nothing to do with his discovery of the shape of DNA.

Why report the crazy and give him press?

Well it's not like they're reporting on whether he's wearing underwear. Ars has covered this unsettling development regularly. The story is not that Stallman is up to some wacky nonsense nobody cares about; the story is that Ubuntu sends your desktop searches for "ingrown_toenail.pdf" or "coed.jpg" to Amazon.com, and Stallman is on the march about it. Reasonable.

I don't get this line of thinking. Privacy is good. Needless invasions of privacy are bad. Ok, got it. Free software is good because you can alter it to do what you want and not be subjected to the iron fist of the software developer when using your own computer, ok. Ubuntu is free software and also does something users may not want. Therefore Ubuntu users can take advantage of the fact that Ubuntu is free and cut the privacy invasion out of it. But don't use it anyway, because that's bad.

It's like the whole point of free software is that YOU can do what you want with it. Ubuntu is still free so users can still remove that Amazon lookup if they want. It's entirely consistent with Stallman's philosophy and offers a great example of why software should be free. Given all that it makes no sense to cast Ubuntu out now. Stallman is negating his own point of view here. There's no point in software being free to alter if we simply refuse to use software (even free software) that has things in it that we might want to alter. If all software was made exactly how Stallman wanted it, he'd have no need of it being free. The purpose of the freedom is to change the things that you want to change. Ubuntu offers that.

Can we please stop reporting on everything that comes out of Stallman?

Get out of it! The guy's not just a legend, steeped in history, but very relevant to the modern day. We need voices like this, even if we do not entirely agree with them. The sort of "I disagree with what you say, but I will defend with my life the right for you to say it".

Quote:

He did some very good work on the early days of the free software movement, but like James Watson and some of his more recent controversial statements, well, they really have nothing to do with his discovery of the shape of DNA.

Why report the crazy and give him press?

And why not? He's newsworthy. You don't actually give a reason why you want RMS censured, so your post doesn't actually have any content in it.

This hurts so very much ... I agree with Stallman here. This does make Ubuntu spyware.

If that bothers you enough, you should probably switch. If it does not (let's face it, I have 18 kinds of spyware on my phone now), then get over it.

I wish Canonical hadn't made this decision, but it's not enough for me to recommend a friend go through a more difficult installation of a Linux distro that's less supported by 3rd party software vendors. Ubuntu *barely* had enough users to get noticed by a few vendors.

But then again, I haven't sent Canonical any donations. So I don't know why I expected to continue to get such a great product for free with no ads.

This privacy tradeoff thing isn't hard. Before sending any information about the user anywhere, you inform them of what information will be collected, and ask their permission. User gets cool new feature, or not, their choice and everyone is happy. But if you just start transmitting personal information behind people's back then your software is spyware, and of course some people are going to be pissed off when they find out after the fact.

I don't know why so many of today's cloud-headed developers can't grasp this simple concept.

Not that Stallman doesn't have his mind on the right place on some subject, but when it come to Spyware, I would indeed take what he said with a grain of salt, for he kind of paranoid when it come to spying, since it the main reason he only do transaction in cash and browse the web on other computer then his own, on top of mailing himself web page through a proxy service.

This is an argumentum ad hominem. What he does and how he does it bears no relation to the point he is making here and now, nor does it make it any more or less valid.

We need to instead examine the behaviour of an OS reporting all your searches to a third party (hell, even to the second party) on its own, as Stallman is suggesting we do.

Say what you like about Stallman (and I've said much of it in the past), he remains a very valuable voice and a benchmark by which positions may be measured.

Canonical aims to get affiliate payments (as others have noted), but also aims to integrate "cloud" with "local", in a way privacy advocates like Stallman do not like. In a way, Stallman loves his walled garden, but that walled garden is his own computer, and he will construct gates in the wall at his leisure, not at Canonical's.

While we may not always agree with Stallman, if we deny his value then we're exposing none but our own ignorance.

Anyway, doesn't ChromeOS essentially do the same thing by keeping all of your data in the Google cloud? (forgive me if I'm wrong about the chromebook, I don't own one but I think one of the main features was its deep integration with Google services).

Anyway, doesn't ChromeOS essentially do the same thing by keeping all of your data in the Google cloud? (forgive me if I'm wrong about the chromebook, I don't own one but I think one of the main features was its deep integration with Google services).

Yes, it does, and this doesn't legitimise it, though it doesn't sell that information on to a third party as Canonical does.

""...is to provide Ubuntu users the fastest, slickest way to find things right from their home environment—independent of whether those 'things' are on your machine, available online, free, or commercial."

This is such BS. The goal of Canonical is to get affiliate payments, just as the article points out. They can masquerade it as a "search enhancement" all they want but it is what it is. As radical as Stallman can be, he has a point here. If I am searching for files on my hard drive, I want it to be just that. I don't want my search to turn into an ad or a way for Amazon to sell me something. Others may feel differently which brings the question, is it possible to turn this feature off?

As for privacy and the exchange of PII information with amazon, after hearing about what facebook is doing with the exchange and matching of "hashed" email addresses and other information with retailers in order to tailor advertisements and track user habits, I no longer believe any of these companies when they say they are not selling your information. They may not be exchanging your information in humanly readable form as originally provided but they sure are exchanging the 1s and 0s that make up who we are...

Yes there are multiple ways to turn this off. It's right in System Settings under privacy. You can also just remove the related shopping lens package as well.

The problem isn't that the feature exists or even what the feature does. The problem is that the feature is turned on by default and does not ask the user for their permission to transmit their search strings over the internet.

Not that Stallman doesn't have his mind on the right place on some subject, but when it come to Spyware, I would indeed take what he said with a grain of salt, for he kind of paranoid when it come to spying, since it the main reason he only do transaction in cash and browse the web on other computer then his own, on top of mailing himself web page through a proxy service.

This is an argumentum ad hominem. What he does and how he does it bears no relation to the point he is making here and now, nor does it make it any more or less valid.

We need to instead examine the behaviour of an OS reporting all your searches to a third party (hell, even to the second party) on its own, as Stallman is suggesting we do.

And that thing can be turned off, or even not have it touch your system at all, if you do a custom install or use one of the spin instead of the mainline, you gonna tell me you don't use a web browser because it had a third party search engine by default ? Cause if that that case of about any browser outside of Internet Explorer, Chrome, since they have their own first party search engine available.

Anyway, doesn't ChromeOS essentially do the same thing by keeping all of your data in the Google cloud? (forgive me if I'm wrong about the chromebook, I don't own one but I think one of the main features was its deep integration with Google services).

Yes, it does, and this doesn't legitimise it, though it doesn't sell that information on to a third party as Canonical does.

It's true that Google doesn't sell the data to a third party, but I have to ask: does that matter? I'd argue that the effect is actually pretty close to the same in either case. Google can deliver you to advertisers (and thus, to product) directly without needing to push you towards Amazon, since that's the business that they are in. Canonical, on the other hand, has an extra step to jump through because they're in a different business than Google.

That's to say, Google doesn't need to sell your data because they can monetize your data directly without needing to go to another party. Canonical can't do that in-house.